refactor: rewrite argument-comment lint wrappers in Python (#16063)

## Why

The `argument-comment-lint` entrypoints had grown into two shell
wrappers with duplicated parsing, environment setup, and Cargo
forwarding logic. The recent `--` separator regression was a good
example of the problem: the behavior was subtle, easy to break, and hard
to verify.

This change rewrites those wrappers in Python so the control flow is
easier to follow, the shared behavior lives in one place, and the tricky
argument/defaulting paths have direct test coverage.

## What changed

- replaced `tools/argument-comment-lint/run.sh` and
`tools/argument-comment-lint/run-prebuilt-linter.sh` with Python
entrypoints: `run.py` and `run-prebuilt-linter.py`
- moved shared wrapper behavior into
`tools/argument-comment-lint/wrapper_common.py`, including:
  - splitting lint args from forwarded Cargo args after `--`
- defaulting repo runs to `--manifest-path codex-rs/Cargo.toml
--workspace --no-deps`
- defaulting non-`--fix` runs to `--all-targets` unless the caller
explicitly narrows the target set
  - setting repo defaults for `DYLINT_RUSTFLAGS` and `CARGO_INCREMENTAL`
- kept the prebuilt wrapper thin: it still just resolves the packaged
DotSlash entrypoint, keeps `rustup` shims first on `PATH`, infers
`RUSTUP_HOME` when needed, and then launches the packaged `cargo-dylint`
path
- updated `justfile`, `rust-ci.yml`, and
`tools/argument-comment-lint/README.md` to use the Python entrypoints
- updated `rust-ci` so the package job runs Python syntax checks plus
the new wrapper unit tests, and the OS-specific lint jobs invoke the
wrappers through an explicit Python interpreter

This is a follow-up to #16054: it keeps the current lint semantics while
making the wrapper logic maintainable enough to iterate on safely.

## Validation

- `python3 -m py_compile tools/argument-comment-lint/wrapper_common.py
tools/argument-comment-lint/run.py
tools/argument-comment-lint/run-prebuilt-linter.py
tools/argument-comment-lint/test_wrapper_common.py`
- `python3 -m unittest discover -s tools/argument-comment-lint -p
'test_*.py'`
- `python3 ./tools/argument-comment-lint/run-prebuilt-linter.py -p
codex-terminal-detection -- --lib`
- `python3 ./tools/argument-comment-lint/run.py -p
codex-terminal-detection -- --lib`

tools/argument-comment-lint/test_wrapper_common.py

@@ -0,0 +1,88 @@
+#!/usr/bin/env python3
+
+from __future__ import annotations
+
+from pathlib import Path
+import unittest
+
+import wrapper_common
+
+
+class WrapperCommonTest(unittest.TestCase):
+    def test_defaults_to_workspace_and_all_targets(self) -> None:
+        parsed = wrapper_common.parse_wrapper_args([])
+        final_args = wrapper_common.build_final_args(parsed, Path("/repo/codex-rs/Cargo.toml"))
+
+        self.assertEqual(
+            final_args,
+            [
+                "--manifest-path",
+                "/repo/codex-rs/Cargo.toml",
+                "--workspace",
+                "--no-deps",
+                "--",
+                "--all-targets",
+            ],
+        )
+
+    def test_forwarded_cargo_args_keep_single_separator(self) -> None:
+        parsed = wrapper_common.parse_wrapper_args(["-p", "codex-core", "--", "--tests"])
+        final_args = wrapper_common.build_final_args(parsed, Path("/repo/codex-rs/Cargo.toml"))
+
+        self.assertEqual(
+            final_args,
+            [
+                "--manifest-path",
+                "/repo/codex-rs/Cargo.toml",
+                "--no-deps",
+                "-p",
+                "codex-core",
+                "--",
+                "--tests",
+            ],
+        )
+
+    def test_fix_does_not_add_all_targets(self) -> None:
+        parsed = wrapper_common.parse_wrapper_args(["--fix", "-p", "codex-core"])
+        final_args = wrapper_common.build_final_args(parsed, Path("/repo/codex-rs/Cargo.toml"))
+
+        self.assertEqual(
+            final_args,
+            [
+                "--manifest-path",
+                "/repo/codex-rs/Cargo.toml",
+                "--no-deps",
+                "--fix",
+                "-p",
+                "codex-core",
+            ],
+        )
+
+    def test_explicit_manifest_and_workspace_are_preserved(self) -> None:
+        parsed = wrapper_common.parse_wrapper_args(
+            [
+                "--manifest-path",
+                "/tmp/custom/Cargo.toml",
+                "--workspace",
+                "--no-deps",
+                "--",
+                "--bins",
+            ]
+        )
+        final_args = wrapper_common.build_final_args(parsed, Path("/repo/codex-rs/Cargo.toml"))
+
+        self.assertEqual(
+            final_args,
+            [
+                "--manifest-path",
+                "/tmp/custom/Cargo.toml",
+                "--workspace",
+                "--no-deps",
+                "--",
+                "--bins",
+            ],
+        )
+
+
+if __name__ == "__main__":
+    unittest.main()